Privacy Policy

octa.social is operated by Octafield (Pty) Ltd ("Octafield", "we", "us"), a company registered in South Africa. This policy explains what personal information we collect when you use octa.social, why we collect it, how long we keep it, and the choices you have. It is written to comply with the Protection of Personal Information Act, 2013 (POPIA) and with Meta Platform Terms governing Instagram data.

01Who this covers

This policy applies to athletes and their authorised representatives (agents and managers) who claim or manage a profile on octa.social, to brands using our partner directory, and to visitors of any octa.social page.

02Information we collect

• Account information — your name, email address, and password (stored as a cryptographic hash), and for agents, the athletes you are authorised to represent.
• Profile content you provide — photos, biography, links, and partner information you add to your page.
• Sports performance data — match statistics, results, rankings and career history sourced from official competition data and public results (e.g. World Athletics), which Octafield independently collects and verifies as part of its media platform.
• Instagram data (only if you connect your account) — described in full in section 3.
• Usage data — page views, link clicks and referral sources on your public page, collected via Google Analytics and our own click logging. We use this to power your analytics dashboard.
• Payment information — if you subscribe to a paid plan, payments are processed by our payment provider; we store your subscription status and billing history, never your full card number.

03Instagram data — exactly what we access

If you choose to connect your Instagram professional account, you authorise us through Meta's official Instagram API with two permissions:

• instagram_business_basic — your Instagram user ID, username, account type, follower count, media count, and your media (captions, media URLs, permalinks, timestamps, like and comment counts).
• instagram_business_manage_insights — aggregate insights for your own account: reach, views, and audience information.

We use this data for one purpose: to display your content and verified reach on your own octa.social page, media kit, analytics dashboard and campaign reports. We copy media images to our own storage so your page loads reliably. We never post on your behalf, never read or send messages, never access other accounts' private data, and never sell Instagram data to anyone.

04How we use information

• To operate your public athlete page and keep it current through automated syncs.
• To generate your media kit, analytics and campaign reports.
• To route partnership inquiries from brands to you or your authorised agent.
• To process subscriptions and provide support.
• To secure the service, prevent abuse, and comply with law.

We do not sell personal information. We do not use your information for third-party advertising.

05Who we share it with

• Service providers that host and run octa.social: Supabase (database and storage), Vercel (hosting), Google Analytics (usage measurement), and our payment processor. Each processes data only on our instructions.
• Brands — only what your plan and settings make visible: your public page, and the reach and performance figures you choose to display or include in reports you send.
• Your authorised agent, if you granted an agency access to manage your profile.
• Authorities, where the law requires it.

06Retention

We keep account and profile data while your account is active. Instagram data is retained only while your account remains connected; if you disconnect Instagram or delete your account, associated Instagram data is deleted from our systems within 30 days (backup copies expire on a rolling schedule of up to 90 days). Sports performance data is part of Octafield's public sports record and remains published on our media platform independently of your octa.social account.

07Your rights under POPIA

You may request access to, correction of, or deletion of your personal information; object to processing; and lodge a complaint with the Information Regulator (South Africa) — inforegulator.org.za. To exercise any right, email info@octafield.com. We respond within 30 days.

08Disconnecting Instagram & deleting data

Full instructions live at octa.social/data-deletion. In short: disconnect in your octa.social settings, or remove octa.social from Instagram's Settings → Website permissions → Apps and websites, or email us. Any of the three triggers deletion of your Instagram data as described in section 6.

09Cookies & analytics

We use Google Analytics 4 with IP anonymisation and our own first-party click logging to measure page performance — this is the same data that powers your analytics dashboard. We do not run third-party advertising cookies.

10Age

octa.social accounts and marketplace features are available only to persons 18 years or older. We do not offer claims, brand features or subscriptions to minors, and we do not knowingly collect personal information from anyone under 18 in connection with this service.

11Security

Data is encrypted in transit (TLS) and at rest. Access tokens are stored encrypted with restricted access. No system is perfectly secure; if a breach affects your personal information we will notify you and the Information Regulator as POPIA requires.

12Changes & contact

We will post any changes to this policy on this page with a new effective date, and notify account holders of material changes by email. Questions, requests and complaints: info@octafield.com.